A Google shared DevSite platform vulnerability, discovered on October 12, 2026, allowed unauthenticated attackers to forge Flask session cookies and execute remote code via unsafe Python deserialization This article explores vulnerability discovered google. . The researcher demonstrated the exploit using controlled delays rather than directly targeting production infrastructure.
A significant vulnerability was discovered in the Google Developer Site, specifically within the OAuth authorization flow accessible through developers.google.com. Upon visiting /oauth2authorize?return_url=%2F, a Flask session cookie was initiated without requiring an authenticated account. This cookie, approximately 1,200 bytes in size, stands out for its unusual size, considering it contains a return URL and a CSRF token. The Flask `bytes` tag encased a Base64-encoded Python pickle, which contained an `oauth2client.client.OAuth2WebServerFlow` object.
Responses were measured approximately as follows: 0.207 seconds for zero delay, 3.193 seconds for three seconds, 5.194 seconds for five seconds, and 8.283 seconds for eight seconds. A legitimate serialized flow reached Google’s token exchange before failing due to a fabricated authorization code, clearly distinguishing normal processing from payload execution. The disclosure spans across seven Google domains, including developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.
Simonkoeck advised rotating exposed OAuth secrets, invalidating affected sessions, assigning independent server-held signing keys to deployments, retaining OAuth flow objects server-side, and replacing client-controlled pickle data with validated data-only serialization. Join 16,000 SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
